Volcengine Image Studio

Practical image generation workflow for Volcengine/ARK-compatible APIs. Use when users need poster creation, text-to-image, reference-image generation, local...

Security Scan

The skill's code and instructions match an image-generation tool, but the published metadata omits the sensitive environment variables the script requires and the script will transmit local images and write files to your Desktop—review before use.

Purpose & Capability

The SKILL.md and included script clearly implement a Volcengine/ARK-compatible image generation workflow (text-to-image, image-to-image, multi-image, auto-download). That purpose is consistent with the name/description. However the registry metadata claims 'Required env vars: none' while the SKILL.md and script require an API key, model, and endpoint (VOLCENGINE_API_KEY / ARK_API_KEY / OPENAI_API_KEY, VOLCENGINE_MODEL, VOLCENGINE_ENDPOINT). There are also minor manifest inconsistencies (ownerId in _meta.json differs from registry owner ID and slug/identifiers vary), which reduce trust in the package provenance.

Instruction Scope

The runtime instructions stay within image-generation scope: run the bundled Python script with a prompt and optional image refs. Important side effects are explicit: the script can convert local image files to base64 and send them to the remote API, it auto-downloads returned image URLs into a user directory (Desktop by default), and it may open Finder. These behaviors are coherent with the stated purpose but are privacy-impacting and side-effectful.

Install Mechanism

No install spec is provided and the included Python script uses only standard-library modules (urllib, base64, subprocess, etc.). There is no evidence of additional packages being fetched or arbitrary code downloaded at runtime, and no extract/download install steps in the manifest.

Credentials

The script requires sensitive credentials (API key) and endpoint/model configuration to function. Those env vars are reasonable for the stated purpose, but the skill registry metadata does not declare them (primaryEnv unset). The script also accepts aliases (OPENAI_API_KEY etc.), which could lead to unintentional use of unrelated credentials. The number of optional env vars (download dir, watermark flags, streaming, etc.) is reasonable, but the omission from metadata and accepting multiple credential names is a proportionality/visibility problem.

Persistence & Privilege

always:false (normal). The skill does write files to the user's filesystem (Downloads/Desktop or custom dir) and can open Finder—this is expected for a tool that auto-downloads results but is a notable side effect. The skill does not request elevated or cross-skill configuration privileges and does not install persistent background services.

What to consider before installing

This package appears to be a working image-generation script, but review these items before installing or running it: - Credentials: The script requires an API key, model, and endpoint (e.g., VOLCENGINE_API_KEY / VOLCENGINE_MODEL / VOLCENGINE_ENDPOINT). The registry metadata did not declare these — confirm you trust the skill and the endpoint before providing keys. Prefer using an isolated or ephemeral API key. - Local images are transmitted: When you pass local image paths the script base64-encodes them and sends them to the remote API. Do not use sensitive/private images unless you trust the target service. - Auto-downloads and filesystem writes: By default results are downloaded to your Desktop and the script may open Finder; set --download-dir to a safe location if you prefer. - Provenance inconsistencies: The manifest shows mismatched owner/slug identifiers; there is no homepage and the source is unknown. If you need higher assurance, ask the publisher for a canonical source or review the script locally before running. - Code review: The included script is short and uses only standard libraries; there is no evidence of remote install or obfuscated code. If you will run it, inspect generate_image.py yourself and consider running it in a controlled environment (container or VM) and avoid sharing production/unrelated credentials. If any of the above concerns worry you (especially transmitting local images or providing API keys), do not install or run the skill until you verify the endpoint and publisher.

Use this skill to actually generate images through a Volcengine/ARK-compatible image endpoint.

中文说明

这是一个面向 火山引擎 / ARK 兼容图片生成接口 的实战型 skill，不只是帮你写提示词，而是直接把图片生成跑起来。

适用场景包括：

• 生成海报、宣传图、配图
• 文生图
• 单张或多张参考图生图
• 直接使用本地图片作为输入
• 一次生成多张结果图
• 自动下载生成结果到本地

Default path

Run the bundled script:

python3 scripts/generate_image.py "<prompt>"

By default, URL results are auto-downloaded to Desktop. For multi-image runs, the script creates a new folder per run automatically and opens that folder in Finder.

Required config

The script reads config from env vars:

• VOLCENGINE_API_KEY or ARK_API_KEY
• VOLCENGINE_MODEL or ARK_MODEL
• VOLCENGINE_ENDPOINT or ARK_BASE_URL

Supported modes

1. Text to image

python3 scripts/generate_image.py "极简科技海报，深色背景，蓝紫色霓虹光效，高级感"

2. One local reference image → one new image

python3 scripts/generate_image.py "生成狗狗趴在草地上的近景画面" \
  --image ~/Desktop/dog-reference.png \
  --sequential-image-generation disabled

3. One reference image URL → one new image

python3 scripts/generate_image.py "生成狗狗趴在草地上的近景画面" \
  --image "https://ark-project.tos-cn-beijing.volces.com/doc_image/seedream4_imageToimage.png" \
  --sequential-image-generation disabled

4. One reference image → multiple new images

python3 scripts/generate_image.py "参考这个LOGO，做一套户外运动品牌视觉设计，品牌名称为GREEN，包括包装袋、帽子、纸盒、手环、挂绳等。绿色视觉主色调，趣味、简约现代风格" \
  --image "https://ark-project.tos-cn-beijing.volces.com/doc_image/seedream4_imageToimages.png" \
  --sequential-image-generation auto \
  --sequential-max-images 5 \
  --stream true

5. Multiple reference images → multiple new images

python3 scripts/generate_image.py "生成3张女孩和奶牛玩偶在游乐园开心地坐过山车的图片，涵盖早晨、中午、晚上" \
  --image "https://ark-project.tos-cn-beijing.volces.com/doc_image/seedream4_imagesToimages_1.png" \
  --image "https://ark-project.tos-cn-beijing.volces.com/doc_image/seedream4_imagesToimages_2.png" \
  --sequential-image-generation auto \
  --sequential-max-images 3 \
  --stream true

You can also pass a local text file of URLs/paths:

python3 scripts/generate_image.py "根据参考图生成多张变体" --image-file ./refs.txt

Local image path support

• --image ~/Desktop/ref.png → automatically converted to a data: URL with base64
• --image https://... → sent as-is
• --image data:image/png;base64,... → sent as-is

This lets you use local files directly without manually converting them.

Auto-download behavior

When the API returns image URLs, the script downloads them to Desktop by default.

Example download behavior:

• Single image: ~/Desktop/1710000000-my-prompt-1.jpeg
• Multi-image run: ~/Desktop/1710000000-my-prompt/1710000000-my-prompt-1.jpeg

Disable auto-download if needed:

python3 scripts/generate_image.py "极简科技海报" --download-results false

Custom download directory:

python3 scripts/generate_image.py "极简科技海报" --download-dir ~/Downloads/volcengine

Force a new folder even for single-image runs:

python3 scripts/generate_image.py "极简科技海报" --download-folder-per-run true

Disable per-run folders:

python3 scripts/generate_image.py "极简科技海报" --download-folder-per-run false

Disable auto-opening Finder:

python3 scripts/generate_image.py "极简科技海报" --open-download-folder false

Optional env vars

• VOLCENGINE_IMAGE_SIZE (example: 2K)
• VOLCENGINE_IMAGE_COUNT (default 1)
• VOLCENGINE_IMAGE_QUALITY (default standard)
• VOLCENGINE_RESPONSE_FORMAT (default url)
• VOLCENGINE_SEQUENTIAL_IMAGE_GENERATION (disabled / auto)
• VOLCENGINE_SEQUENTIAL_MAX_IMAGES (example: 3)
• VOLCENGINE_STREAM (true / false)
• VOLCENGINE_WATERMARK (true / false)
• VOLCENGINE_OUTPUT_DIR (default generated-images)
• VOLCENGINE_DOWNLOAD_RESULTS (default true)
• VOLCENGINE_DOWNLOAD_DIR (default ~/Desktop)
• VOLCENGINE_DOWNLOAD_FOLDER_PER_RUN (auto / true / false, default auto)
• VOLCENGINE_OPEN_DOWNLOAD_FOLDER (auto / true / false, default auto)
• VOLCENGINE_TIMEOUT (default 120)

Execution checklist

1. Confirm prompt, target style, and whether reference images are needed.
2. Add --image once for single-reference generation, or repeat it for multi-reference generation.
3. For local images, pass the local path directly; the script converts it to base64 data URL automatically.
4. For single-image-to-multi-image and multi-reference sequences, set --sequential-image-generation auto and --sequential-max-images <N>.
5. Use --stream true when the API returns incremental image events.
6. By default, returned image URLs are downloaded to Desktop; multi-image runs go into a new folder automatically.
7. Mention the downloaded paths or folder path in the result.
8. For multi-image runs, let Finder open the created folder unless the user disabled it.
9. If it fails, surface the exact HTTP error or missing field.

Release positioning

Compared with an earlier bare-bones generation flow, this version is packaged around the logic that proved usable in practice:

• supports Volcengine / ARK-compatible endpoint patterns
• supports reference-image workflows, including local files
• supports sequential multi-image generation
• supports automatic result download and run-based folder grouping
• better fits poster and commercial visual production

Troubleshooting

• Missing key → set VOLCENGINE_API_KEY
• Missing model → set VOLCENGINE_MODEL
• Missing endpoint → set VOLCENGINE_ENDPOINT
• Local file not found → check the --image path
• 401/403 → key invalid or lacks permission
• 404/405 → endpoint wrong
• 400 → model/size/request body incompatible with the target API
• No returned files/URLs → inspect raw in the JSON output

References

• references/sources.md found → check the --image path
• 401/403 → key invalid or lacks permission
• 404/405 → endpoint wrong
• 400 → model/size/request body incompatible with the target API
• No returned files/URLs → inspect raw in the JSON output

References

• references/sources.md inspect raw in the JSON output

References

• references/sources.md